services:
  markdown-to-caldav:
    build: .
    image: markdown-to-caldav:latest
    container_name: markdown-to-caldav
    restart: unless-stopped

    # Files written back into your notes must stay owned by you, not root.
    # Defaults to 1000:1000; override in .env or the environment.
    user: "${VAULT_UID:-1000}:${VAULT_GID:-1000}"

    ports:
      # Host 5233 avoids colliding with an existing Radicale on 5232.
      - "127.0.0.1:5233:5232"

    volumes:
      - ${VAULT_PATH:-./vault}:/vault
      - ./docker:/config:ro
      - ./data:/data

    environment:
      MDCALDAV_CONFIG: /config/mdcaldav.toml

    security_opt:
      - no-new-privileges:true